skills.rest
hekivo
hekivoOFFICIAL
Explore all skills by this author →
WebsiteGitHub

superpowers-sage:wp-security

Enforce sanitization, escaping, and authorization rules in WordPress/Sage/Acorn code.

13|Updated Mar 19, 2026
Search Tags:#secret management#wordpress#security hardening#csrf protection#xss protection#sql injection prevention#nonce verification
One-click install
npx skills add https://github.com/hekivo/superpowers-sage --skill superpowers-sage-wp-security-hekivo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: superpowers-sage:wp-security
Source: https://github.com/hekivo/superpowers-sage/tree/main/skills/wp-security
Command: npx skills add https://github.com/hekivo/superpowers-sage --skill superpowers-sage-wp-security-hekivo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill prevents common security vulnerabilities in WordPress/Sage/Acorn projects by enforcing consistent input sanitization, output escaping, permission checks, and safe database and secret handling.

Core Features & Use Cases

  • Input sanitization: Apply the appropriate sanitizers for text, emails, URLs, integers, filenames, and safe HTML before storing or processing data.
  • Output escaping: Escape dynamic values in Blade templates by using the safe rendering patterns and contextual escaping helpers to reduce XSS risk.
  • Request and authorization hardening: Verify nonces (where applicable) and enforce current_user_can() capability checks for privileged actions.
  • SQL injection prevention: Require $wpdb->prepare() for raw $wpdb queries and avoid unsafe patterns like raw user input in DB::raw() or whereRaw() without bindings.
  • CSRF and upload safety: Ensure Acorn/WordPress CSRF protections are active and validate uploaded files server-side using MIME checks.
  • Secrets management: Keep secrets out of the codebase by storing them in .env and accessing via env()/config().

Quick Start

Ask your AI assistant to review a feature’s controller/service and Blade output using the superpowers-sage:wp-security checklist, and to point out any missing nonce verification, capability checks, escaping gaps, unsafe $wpdb usage, insecure uploads, or hardcoded secrets.

Frequently Asked Questions about superpowers-sage:wp-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in WordPress $wpdb queries?▼

To prevent SQL injection in WordPress $wpdb queries, you must use `$wpdb->prepare()` for all raw database interactions and avoid unsafe patterns like passing raw user input into `DB::raw()` or `whereRaw()` without proper parameter bindings.

What is the best way to sanitize input and escape output in Sage Blade templates?▼

Sanitizing input and escaping output in Sage Blade templates requires applying appropriate sanitizers for text, emails, and URLs before storage, then using safe rendering patterns and contextual escaping helpers during Blade rendering to reduce XSS risk.

How do I verify nonces and check user capabilities in WordPress AJAX and REST endpoints?▼

Verifying nonces and checking user capabilities in WordPress AJAX and REST endpoints involves enforcing nonce verification where relevant and applying `current_user_can()` capability checks for all privileged actions to harden request authorization.

How should I manage WordPress secrets and environment variables securely?▼

Managing WordPress secrets securely requires moving hardcoded secrets out of the codebase into a `.env` file and accessing them exclusively via the `env()` or `config()` helper functions to prevent accidental exposure.

Does this security hardening approach work with custom WordPress file uploads?▼

Yes, this security hardening approach works with custom WordPress file uploads by enforcing server-side validation using strict MIME type checks to ensure only safe files are processed and stored.

Related Skills

Explore More Legal & Compliance Skills→
codigodoleocodigodoleo
13

superpowers-sage:wp-phpstan

Run PHPStan static analysis on Sage/Acorn WordPress projects.

Official
Intermediate
jeremylongshorejeremylongshore
2.6k

scanning-database-security

Scan PostgreSQL and MySQL databases for security vulnerabilities and generate remediation reports.

Community
Advanced
TeiNamTeiNam
12

laravel-verification

Automate Laravel project verification for CI/CD pipelines.

Community
Advanced
SnailSploitSnailSploit
2.9k

waf-bypass

Detect WAFs and apply encoding, header, and protocol bypass techniques.

Community
Advanced